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Abstract 

The National Aeronautics and Space Administration (NASA) at the Dryden Flight Research Center 
(DFRC) has been conducting flight-test research using an F-15 aircraft (figure 1). This aircraft has been 
specially modified to interface a neural net (NN) controller as part of a single-string Airborne Research Test 
System (ARTS) computer with the existing quad-redundant flight control system (FCC) shown in figure 2. 
The NN commands are passed to FCC channels 2 and 4 and are cross channel data linked (CCDL) to the 
other computers as shown. Numerous types of fault-detection monitors exist in the FCC when the NN mode 
is engaged; these monitors would cause an automatic disengagement of the NN in the event of a triggering 
fault. Unfortunately, these monitors still may not prevent a possible NN hard-over command from coming 
through to the control laws. Therefore, an additional and unique safety monitor was designed for a single- 
string source that allows authority at maximum actuator rates but protects the pilot and structural loads against 
excessive g-limits in the case of a NN hard-over command input. This additional monitor resides in the FCCs 
and is executed before the control laws are computed. 

This presentation describes a “floating limiter” (FL) concept 1 that was developed and successfully 
test-flown for this program (figure 3). The FL computes the rate of change of the NN commands that are 
input to the FCC from the ARTS. A window is created with upper and lower boundaries, which is constantly 
“floating” and trying to stay centered as the NN command rates are changing. The limiter works by only 
allowing the window to move at a much slower rate than those of the NN commands. Anywhere within the 
window, however, full rates are allowed. If a rate persists in one direction, it will eventually “hit” the 
boundary and be rate-limited to the floating limiter rate. When this happens, a persistent counter begins and 
after a limit is reached, a NN disengage command is generated. The tunable metrics for the FL are (1) 
window size, (2) drift rate, and (3) persistence counter. Ultimate range limits are also included in case the NN 
command should drift slowly to a limit value that would cause the FL to be defeated. 

The FL has proven to work as intended. Both high-g transients and excessive structural loads are 
controlled with NN hard-over commands. This presentation discusses the FL design features and presents test 
cases. Simulation runs are included to illustrate the dramatic improvement made to the control of NN hard- 
over effects. A mission control room display from a flight playback is presented to illustrate the neural net 
fault display representation. The FL is very adaptable to various requirements and is independent of flight 
condition. It should be considered as a cost-effective safety monitor to control single-string inputs in general. 

1 “Design of Safety Monitor Schemes for a Fault Tolerant Flight Control System,” IEEE Transactions on 
Aerospace and Electronic Systems Vol. 42, No. 2, April 2006. 

Richard R. Larson 
Flight Systems Engineer 
NASA DFRC 
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Figure 1 - F15 Intelligent Flight Control System Test Bed Aircraft 
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Figure 2 - Neural Net Controller Architecture with Flight Control Computers 


Upper range limit (down mode) 



Black - sigma pi cmd 
Green - floating limiter boundary 
Orange - limited command (fl_drift_flag) 
Red - down mode condition (fl_dmode_flag 


Tunable metrics 
Window delta 
Drift rate 

Persistence limiter 
Range limits 


Figure 3 - Floating Limiter Features 
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Overview 




• Requirements 

• Neural net interfaces 

• Design approach 

• Review of existing safety monitors 

• New safety monitor developed 

• Testing 

• A surprise 

• Flight data display playback 

• Summary 
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Requirements 




* Interface neural net controller with FI 5 enhanced 
control laws for flight test experiment 

- Flight conditions: 0.75M/20Kft, and 0.90M/25Kft 

- Maximum transients: + 2g vertical, + 0.5g lateral 

- Maneuvers: Straight & level, 3g wind-up-turn (WUT), simulated 
stabilator/canard failures, loads maneuvers; all maneuvers 
include pitch/roll/yaw (pqr) doublets 

• Ground Rules/Constraints 

- Protect from exceeding any aircraft structural load limits 

- Avoid departure from controlled flight 

- Neural net commands shall support full control surface 
authority at maximum actuator rates 

- Minimize nuisance disengagements 



AIAA InfoTech 2007 - Neural Net Safety Monitor 


3 


Neural Net Interfaces 


CCDL 



BC Bus Controller 
NNCL Neural Net Control Laws 
NNSM Neural Net Safety Monitor 
SBC Single Board Computer 
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Design Approach 




Specific Aircraft faults which occur while in neural net 
mode will cause a downmode to conventional mode with a 
1 sec fader 



• Safety monitors are executed in SCE3 at 80hz 

• Disengagement triggers are instrumented and latched 
for analysis 

• All validation testing is done using hardware in the loop 
closed loop simulation 
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Overview of Existing Safety 

Monitors 




• Flight Computer Faults 

- Single failure of any dual channel signal 

- Dual failure of any quad channel signal 

- FC Configuration fault (Config fail) 

- Channel fail 

- BLIN (Bit Level Inspect) code 

- PAL (Pick-a-Limit) Violation 
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FC PAL limits 


Parameter 

Envelope #1 

Envelope #2 

Lower Limit 

Upper Limit 

Lower Limit 

Upper Limit 

Angle of Attack 

-4.0 deg 

12.0 deg 

-4.0 deg 

12.0 deg 

Sideslip Angle 

-5.0 deg 

5.0 deg 

-5.0 deg 

5.0 deg 

Pitch Angle 

-180 deg 

180 deg 

-180 deg 

180 deg 

Bank Angle 

-90 deg 

90 deg 

-180 deg 

180 deg 

Pitch Rate 

-45 deg/sec 

45 deg/sec 

-60 deg/sec 

60 deg/sec 

Roll Rate 

-75 deg/sec 

75 deg/sec 

-300 deg/sec 

300 deg/sec 

Yaw Rate 

-15 deg/sec 

15 deg/sec 

-60 deg/sec 

60 deg/sec 

Normal Acceleration 

0.0 g 

3.0 g 

-1-0 g 

6.0 g 

Lateral Acceleration 

-0.5 g 

0.5 g 

-1.0 g 

1.0 g 

Mach 

0.55 

0.95 

0.55 

0.95 

Qbar 

253 psf 

733 psf 

253 psf 

733 psf 

Altitude 

15000 ft 

35000 ft 

15000 ft 

35000 ft 

Pitch Stick 

-3.1 in 

5.46 in 

-3.1 in 

5.46 in 

Roll Stick 

-4.0 in 

4.0 in 

-4.0 in 

4.0 in 

Yaw Pedal 

-3.25 in 

3.25 in 

-3.25 in 

3.25 in 

Throttle (PLA) 

16.5 deg 

130 deg 

16.5 deg 

130 deg 
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FC Configuration Faults 


1 . Lt Throttle Within PAL Limits 

2. Rt Throttle Within PAL Limits 

3. Flaps in Correct PAL Mode 

4. Landing Gear in Correct PAL Mode 

5. Throttle Switch in Correct PAL Mode 

6. Spin Switch in Correct PAL Mode 

7. Weight-On-Wheels in Correct PAL Mode 

8. Qbar Limit Exceeded 

9. Aircraft Not At Trim (pitch/bank monitor) 
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ARTS II Fault Monitors 




• Built in Test Failures 

- failure detected through Periodic Bit (PBIT) 

- failure detected through Power Up Bit (PUBIT) 

• Multibit ECC (error code correction) Memory Errors (ARTS- 
II will log the event and transition to FAILED) 

• 1553 Communications Failure 

- 1553 Wrap Word Failure 

• ARTS Neural Net (Sigma Pi) Failures 

- failure to initialize data recording 

- failure to register experiment with Executive 

- failure to receive data from SBC 1 (VXMP failure) 

- failure to send data to SBC 1 (VXMP failure) 
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ARTS II Fault Monitors 

(Continued) 

• Executive Failures: 

- failure to detect correct checksum 

- failure to receive data from Sigma Pi on SBC 2 (VXMP failure) 

- failure to send data to SBC 2 (VXMP failure) 

- The system monitor (SYSMON) task detects a problem with 
any other task such as failure to initialize or abnormal 
termination 

- SBC board boot failure 

• Analog Failures: 

- analog card fails to load driver 

- analog card fails to calibrate 

• Any disk I/O errors 
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Structural Safety Monitoring 

• Added strain gages to aircraft for loads measurements 

• Converted existing loads model from FORTRAN to ADA, 
but memory size too large and execution time too long to fit 
in 80hz frame cycle in SCE3 

• Existing loads model was not validated 

• No confidence that existing fault monitors would prevent a 
Neural Net hardover from exceeding aircraft G and 
structural load limits 

• Conclusion was a new safety monitor was needed 

- A Floating Limiter Design was developed 
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Floating Limiter Design 




• Apply floating limiter windows for the sigma pi (neural net) 
commands (P,Q,R) 

• Maximum rate of change is allowed within the window 

• Limit the rate of change while on the floating limiter 
boundary 

• Allow full authority up to the range limiter 

• Provide flags to sigma pi to stop learning 
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NN Floating Limiter 




Upper range limit (down mode) 



Tunable metrics 

Black - sigma pi cmd Window delta 

Green - floating limiter boundary Drift rate 

Orange - limited command (fl_drift_flag) Persistence limiter 

Red - down mode condition (fl_dmode_flag Range limits 
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Floating Limiter Metrics 
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Floating Limiter Regions 
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Simulation Testing 




• Flight conditions (2 design points) 

- .75M/20Kft 

- .90M/25Kft (worst case) 

• Maneuvers 

- Straight & level with pqr doublets 

- 3g WUT with pqr doublets 

- Simulated failures 

• Straight & level with pqr doublets 

• 3g WUT with pqr doublets 

- Loads maneuvers 
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Software Testing Maneuvers 


Bank angle captures (60 deg) 
P doublets 
Q doublets 
R doubles 

Stab fails; 0 from trim 
Stab fails; +2 from trim 
Stab fails; -2 from trim 
Stab fails; +4 from trim 
Stab fails; -4 from trim 
Stab fails; +4 from trim with p 
Stab fails; +4 from trim with q 
Stab fails; +4 from trim with r 
Sigma Pi hardover from trim 
Sigma Pi hardover from trim 
Sigma Pi hardover from trim 
Sigma Pi hardover from trim 
Sigma Pi hardover from trim 
Sigma Pi hardover from trim 


doublet 
doublet 
doublet 
+p no fail 
-p no fail 
+q no fail 
-q no fail 
+r no fail 
-r no fail 


Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Sigma Pi hardover from 
Roll doublet in 3g WUT 
Pitch doublet in 3g WUT 
Yaw doublet in 3g WUT 


trim; +p, 4 deg fail 
trim; -p, 4 deg fail 
trim; +q, 4 deg fail 
trim; -q, 4 deg fail 
trim; +r, 4 deg fail 
trim; -r, 4 deg fail 
3g WUT; +p, 4 deg fail 
3g WUT; -p, 4 deg fail 
3g WUT; +q, 4 deg fail 
3g WUT; -q, 4 deg fail 
3g WUT; +r, 4 deg fail 
3g WUT; -r, 4 deg fail 
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Within floating limiter: 
no rate limiting 
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Outside floating limiter: 
Minor Rate Limiting 



60 61 62 63 64 65 


Red indicates rate limit 


Time, sec 


FL boundary 
Sigma pi cmd 
FL boundary 
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Outside floating limiter: 
Moderate Rate Limiting 



FL boundary 


Sigma pi cmd 


FL boundary 


Red indicates rate limit 


Time, sec 
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Floating Limiter Constants 



Rt Stab Failure from Trim 

P 

Q 

R 

fl_drift_table_conf_file 

axis 

axis 

axis 

0 deg, dps 3 




Transition 

150 

50 

0.03 

Final 

500 

90 

0.01 

+2 deg, dps 3 




Transition 

230 

60 

0.03 

Final 

700 

60 

0.02 

+4 deg, dps 3 




Transition 

430 

60 

0.03 

Final 

850 

60 

0.02 

-2 deg, dps 3 




Transition 

230 

60 

0.03 

Final 

525 

60 

0.09 

-4 deg, dps 3 




Transition 

430 

60 

0.03 

Final 

550 

60 

0.09 


Canard 

P 

Q 

R 

AOA fails 

axis 

axis 

axis 

Set 1 ; dps 3 




Transition 

100 

1 

0.03 

Final 

100 

1 

0.03 

Set 2; dps 3 




Transition 

100 

20 

0.03 

Final 

100 

20 

0.03 

Metrics 




Initial drift, dps 3 

1.0 

1.0 

0.01 

Delta, dps 2 

200 

52 

0.10 

Range limit, dps 2 

1000 

500 

0.10 

Persistence time, sec 

0.75 

1.25 

0.75 

Transition time, sec 

3 
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Floating Limiter Outputs 


Parameter 

Description 

Units 

Bus 

RT 

SA 

W 

Bit 

fl dmode flag (0), p 

fl plim flag(O) or 

flhrangeflag(O) 

bit 

FC 

15 

2 

25 

00 

fldmodeflag (1), q 

fl_plim_flag(l) or 

flhrangeflag(l) 

bit 

FC 

15 

2 

25 

01 

fl dmode flag (2), r 

fl_plim_flag(2) or 

fl_hrange_flag(2) 

bit 

FC 

15 

2 

25 

02 

fldriftflag (0), p 

NN cmd (p) is limited 

bit 

FC 

15 

2 

25 

03 

fldriftflag (1), q 

NN cmd (q) is limited 

bit 

FC 

15 

2 

25 

04 

fl drift flag (2), r 

NN cmd (r) is limited 

bit 

FC 

15 

2 

25 

05 

flplimflag (0) p 

persistence ctr (p) is max - 
downmode 

bit 

FC 

15 

3 

2 

10 

flplimflag (1) q 

persistence ctr (q) is max - 
downmode 

bit 

FC 

15 

3 

2 

11 

fl plim flag (2) r 

persistence ctr (r) is max - 
downmode 

bit 

FC 

15 

3 

2 

12 

flhrangeflag (0), p 

NN cmd (p) is at hard range 
limit - downmode 

bit 

FC 

15 

3 

2 

13 

flhrangeflag (1), q 

NN cmd (q) is at hard range 
limit - downmode 

bit 

FC 

15 

3 

2 

14 

fl hrange flag (2), r 

NN cmd (r) is at hard range 
limit - downmode 

bit 

FC 

15 

3 

2 

15 
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Sigma Pi Pitch Hardover 



Sigma Pi pitch command hardover from trimmed flight 

9/25K 






NZ. LLraLter 
NZ. no L ira Lter 


Fi ]e=c del. dat ; S 5 gna] Suffi tl=. sera ; Date= [no ne] 
Fi]e=cdc2.dat; Signal Suffi n o sm ; Date=[none] 
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Sigma Pi Roll Hardover 

Sigma JPi roll command hardover from trimmed flight 

9/25K 
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Sigma Pi Roll Hardover: 

no floating limiter 


. FI 5 HUDD 
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Sigma Pi Roll Hardover: 

with floating limiter 


FI5 HUDD 
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Sigma Pi Yaw Hardover 


Sigma Pi yaw command hardover from trimmed flight 

9/25K 




Time, sec 

P r i]«=cc3r5*diit:; S 5 g:n^al Suffi x=. n o sm ; Date=[none] 

IF5 ]e=c d c6 . - S 5 g;n^i] Suffi-x.=.sm; Date=[none] 
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Floating limiter signals Normal Acc, g 


Sigma Pi Pitch Hardover 

4 deg stab fail 


Sigma 1 pitcli 


from trimmed 
.9/25K 


fliglit al ter 4de{ 


stab f:i 1 1 



File =c rlrS _ fiat ; Signal Suffix=.nosm.; Date=[none] 
File=cdr7 . dat ; Signal Suffix=.sm; Date= [none] 
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Floating litnitet signals Angle of Attack, g Normal Acc, g Lateral Acc,g 



Sigma Pi Roll Hardover 

4 deg stab fail 



Sigma Pi roll command hardover from trimmed flight after 4deg stab Pail 

.9/25K 



NY . not L raitei- 
TNYT . I L miter 
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AO A. noltmitei- 
AO A. Ll m iter 
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T A DA EEt H. StV-1 
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Floating limiter signals Beta, deg Lateral Acc, g 



Sigma Pi Yaw Hardover 

4 deg stab fail 



Sigma Pi yaw co m maud hardover from trimmed flight after 4deg stab fail 

.9/25K 
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Sigma Pi signals FL flags (stop Sigma Pi learning) 



Sigma Pi - moderate doublets 

floating limiter flags 



Moderate Sigma IPi doublets after 4deg stab fail 

.9/25K 
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Surprise 

An Unexpected Test Anomaly 

• Discrepancy excerpt: 

“During dry runs of the supplemental HILS tests on ifcs_051g to simulate 
ARTSII failure modes , a four channel left stabilator shutdown was 
experienced as a result of dropping the ARTS_OK_to_Couple Flag in 
channel 2 with Neural Nets Enabled, and a simulated Stab failure. 

The test scenario was duplicated five times, one case all four channels of 
the left stabilator turned off. In all other cases, either just ch 1 and 2 or 
just ch3 and 4 stabilator failed (2 channel vs four channel fail). The test 
was run at M.75 @20K with PAL=8 and DAG=21 (4 deg left stab bias).” 

BLIN code F143 = left stabilator current disconnect 
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An Unexpected Test Anomaly 


• Analysis 

An FCC fault in channel 2 was created which resulted in that channel 
initiating the downmode logic from neural net to the conventional control 
laws. This downmode logic did not occur during the same minor frames 
in the FCC, resulting in different commands to the 4 channel actuator 
electronics. Consequently, a force fight was created which triggered the 
stab current monitor. 

* Corrective Action 

Add downmode information to the FCC cross channel data link so that all 
the FCC channels transition in the same frame thereby eliminating the 
force fight condition 
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Mission Control Data Display 

- from flight playback 

• IADS display playback showing floating limiter from the 
neural net pitch command being set 

• 3g WUT maneuver with 2 deg left stab lock fail set 

• Neural net engaged 
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Mb IFCS SYSItMS rULUtH - rbJr 
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Floating Limiter Summary 




• Meets disengage transients criteria for NN hardover 
(accelerations and loads) 

- Worst case 4 deg stab failure 

- Worst case canard failure 

- Worst case flight condition 

- Aggressive maneuvering flight 

• Piloted simulation shows disengagements are acceptable, 
also validated from flight test 

• No nuisance disengagements 

• Concept may be applied to any single string controller, not 
only neural net commands 
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